CVE-2004-1391
UnknownEPSS 0.56%
Last modified
CVE-2004-1391 is a vulnerability of currently unknown severity. Untrusted execution path vulnerability in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allows local users to execute arbitrary programs by modifying the PATH environment variable to point to a malicious mount program.. EPSS estimates a 0.56% chance of exploitation in the next 30 days.
Description
Untrusted execution path vulnerability in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allows local users to execute arbitrary programs by modifying the PATH environment variable to point to a malicious mount program.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Qnx | Rtos | 6.1.0 |
| Qnx | Rtos | 6.1.0a |
| Qnx | Rtos | 6.2.0 |
| Qnx | Rtos | 6.2.1a |
| Qnx | Rtos | 6.2.1b |
| Qnx | Rtos | 6.3.0 |
| Qnx | Rtp | 6.1 |
References
- http://www.kb.cert.org/vuls/id/577566Third Party Advisory, US Government Resource
- http://www.kb.cert.org/vuls/id/577566Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2004-1391?
Untrusted execution path vulnerability in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allows local users to execute arbitrary programs by modifying the PATH environment variable to point to a malicious mount program.
How severe is CVE-2004-1391?
Severity scoring for CVE-2004-1391 is pending analysis. The EPSS model estimates a 0.56% probability of exploitation in the next 30 days.
How do I fix CVE-2004-1391?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2004
- CVE-2004-1385phpGroupWare 0.9.16.003 and earlier allows remote attackers …
- CVE-2004-1386TikiWiki before 1.8.4.1 does not properly verify uploaded im…
- CVE-2004-1387The check_forensic script in apache-utils package 1.3.31 all…
- CVE-2004-1388Format string vulnerability in the gpsd_report function for …
- CVE-2004-1389Unknown vulnerability in the Veritas NetBackup Administrativ…
- CVE-2004-1390Multiple buffer overflows in the PPPoE daemon (PPPoEd) in QN…
- CVE-2004-1392PHP 4.0 with cURL functions allows remote attackers to bypas…
- CVE-2004-1393Unknown vulnerability in the tcsetattr function for Sun Sola…
- CVE-2004-1394The pfexec function for Sun Solaris 8 and 9 does not properl…
- CVE-2004-1395The Lithtech engine, as used in (1) Contract Jack 1.1 and ea…
- CVE-2004-1396Winamp 5.07 and possibly other versions, allows remote attac…
- CVE-2004-1397Cross-site scripting (XSS) vulnerability in UseModWiki 1.0 a…
Are you affected by CVE-2004-1391?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST